Privacy Policy

01Who We Are

Moula is operated by SAROMAN SERVICES, a société à responsabilité limitée registered under number 939 635 439, with its registered office at 9 rue des Colonnes, 75002 Paris, France.

SAROMAN SERVICES SARL acts as the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for personal data processed through the Moula service.

For any questions regarding this Policy or your personal data, you may contact us via the contact form available on our website.

02Scope of This Policy

This Privacy Policy explains how we collect, use, store, and protect personal data when you access or use Moula, including when you create an account, subscribe to a paid plan, or interact with our website.

It applies to users located in the European Union and internationally. Where local laws grant additional rights, those rights remain applicable.

03Personal Data We Process

When you use Moula, we may process the following categories of personal data:

• Identification data such as your email address and login credentials when you create an account.
• Account-related information necessary to provide the Service.
• Portfolio and transaction data, which you may enter manually or import via CSV, or which is synced automatically from a linked brokerage account through our data provider SnapTrade.
• Technical information such as IP address, device type, browser type, and operating system.
• Usage information relating to how you interact with the Service, including pages visited and features used.
• Billing information processed through our payment service provider, Stripe.
• Communications exchanged with our support team.

We do not intentionally collect special categories of personal data (such as health data or biometric data). We do not knowingly collect personal data from individuals under 18 years of age.

04Purposes and Legal Bases for Processing

We process personal data for the following purposes:

• To provide and operate the Service, including account creation, authentication, portfolio tracking, and subscription management. This processing is based on the performance of a contract.
• To ensure platform security, prevent fraud, and protect our infrastructure. This processing is based on our legitimate interest in securing our systems and users.
• To improve and develop the Service, including analyzing aggregated usage patterns. Where required by law (notably in the EU), analytics tools are used only on the basis of your consent, except that after a payment-processor billing event we may update your subscription status in our analytics tool regardless of your analytics consent choice, solely to keep our records of paid accounts accurate.
• To comply with our legal and accounting obligations, including retention of billing records under French law. This processing is based on compliance with legal obligations.
• To respond to support requests and user inquiries. This processing is based on the performance of a contract or our legitimate interest in providing customer support.

05Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described above.

• Account data is retained for the duration of your account and is deleted or anonymized upon a verified deletion request submitted via our contact form.
• Billing and accounting records are retained for the period required under applicable French accounting law (generally up to ten years).
• Analytics data is retained for as long as necessary for the purposes described above and may be anonymized or aggregated.
• Support communications are retained for as long as necessary to manage user relations and resolve disputes.
• Security and authentication logs are retained for approximately 90 days, after which they are deleted.
• Records of your cookie and privacy consent choices (used to maintain an audit trail) are retained for up to 13 months, after which they are automatically deleted.

06Recipients of Personal Data

We may share personal data with trusted service providers who assist us in operating Moula, including:

• Hosting and infrastructure providers, including Iconify, which serves icon assets used on the site
• SnapTrade, our brokerage-connection provider, which handles the secure, read-only connection to your brokerage account that we use to sync your holdings and transactions
• Google, if you choose "Continue with Google" to sign in — Google authenticates you and shares your email and basic profile information with us for that purpose; this is separate from, and not conditioned on, the marketing-cookie consent that gates Google Ads/Tag Manager below
• Stripe, which processes subscription payments and billing information
• Resend, which sends transactional emails (verification codes, password resets, alert digests) and, where you have not opted out, product emails, on our behalf
• PostHog (analytics), activated according to your cookie consent choices — blocked by default in the EU, EEA, United Kingdom, and Switzerland unless you opt in, and enabled by default elsewhere unless you opt out (see Section 10) — this includes a session-replay recording of your on-screen clicks and page navigation (our support chat widget is excluded from what gets recorded) — and Sentry (error monitoring), which follows the same consent choices on our public website but, once you are signed in to the app, runs unconditionally — including a session-replay recording for a sample of sessions — so that error reports stay reliable (see Section 10)
• Cloudflare Turnstile, a bot-protection check run on our authentication and contact forms
• Customer support tools (e.g., Crisp), activated according to your cookie consent choices — blocked by default in the EU, EEA, United Kingdom, and Switzerland unless you opt in, and enabled by default elsewhere unless you opt out (see Section 10)
• Advertising partners (Google Ads, Google Tag Manager, DoubleClick, and Reddit's pixel and Conversions API), activated according to your marketing consent choices — blocked by default in the EU, EEA, United Kingdom, and Switzerland unless you opt in, and enabled by default elsewhere unless you opt out (see Section 10)

These providers process personal data on our behalf and are contractually bound to appropriate confidentiality and data protection obligations.

Personal data may also be disclosed if required by law or by a valid request from public authorities.

We also rely on market-data and financial-filing providers to power the Service's content: Marketstack supplies quote and market data, and SEC EDGAR (and, for European issuers, ESEF filings via filings.xbrl.org) supplies the fundamentals data shown on the Service. These providers supply data to us; they do not receive or process your personal data.

07International Data Transfers

Some of our service providers may be located outside the European Union, including in the United States.

Where personal data is transferred outside the EU, we ensure that appropriate safeguards are implemented in accordance with GDPR, such as:

• Transfers to entities certified under the EU–U.S. Data Privacy Framework where applicable; or
• Standard Contractual Clauses approved by the European Commission.

These safeguards are intended to ensure that personal data benefits from a level of protection essentially equivalent to that guaranteed within the European Union.

08Security of Personal Data

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction.

These measures include secure hosting environments, encrypted data transmission (HTTPS), access control mechanisms, and internal policies governing data access.

Despite these safeguards, no system can guarantee absolute security. Users are responsible for maintaining the confidentiality of their login credentials.

09Your Rights

Subject to applicable law, you have the right to:

• Access your personal data
• Request rectification of inaccurate data
• Request deletion of your data
• Request restriction of processing
• Object to certain processing activities
• Request data portability where applicable
• Withdraw consent where processing is based on consent

California residents: Under the California Consumer Privacy Act (CCPA), you may request disclosure of categories of data collected and may request deletion. You may opt out of the "sale" or "sharing" of your personal information via our Cookies page.

You also have the right to lodge a complaint with the French supervisory authority (CNIL) or with the data protection authority of your country of residence within the EU.

California residents may also contact the California Attorney General's office.

Requests may be submitted via our contact form. We may request additional information to verify your identity before responding.

10Cookies and Similar Technologies

Moula uses cookies and similar technologies to operate the Service, ensure security, analyze usage, and, where applicable, support marketing activities.

• Essential cookies necessary for authentication and security are always active.
• Analytics cookies (PostHog) are activated only with your consent where required by applicable law, notably within the EU, EEA, United Kingdom, and Switzerland — with one exception described in Section 4 for keeping billing records accurate after a payment event. PostHog also records a session replay of your on-screen activity (clicks and navigation) under this same consent; our support chat widget is excluded from what is recorded.
• Error-monitoring (Sentry) follows the same consent rule on our public website, but once you sign in to the app it runs unconditionally regardless of your cookie choices — including recording a sample of sessions (and sessions where an error occurred) to help us diagnose issues, and associating your account email with error reports. Only the in-app bug-report widget itself still requires your analytics consent to appear.
• Support cookies (e.g., Crisp chat) for in-app support are activated only with your consent where required.
• Marketing cookies (e.g., Google Ads, Reddit's pixel) are activated only with your consent where required.

The cookies we set are: session (HttpOnly, keeps you signed in), csrf (anti-forgery token, cleared after a successful sign-in, verification, or password reset), google_oauth_state (HttpOnly, a short-lived anti-CSRF value used only during "Continue with Google" sign-in), consent_id (HttpOnly, the audit-trail identifier described in Section 5, retained up to 13 months), and moula_consent_region (not HttpOnly, retained up to 1 year, holds your detected region — EU/UK/EEA/Switzerland or elsewhere — so the right consent default can be applied before you make a choice). If you arrive via a Google or Reddit ad link, or a link carrying campaign (UTM) parameters, we also store that identifier in a first-party cookie (moula_signup_utm, moula_google_click, or moula_reddit_click, each retained up to 30 days) so a later signup can be correctly attributed; these identifiers are only passed on to Google or Reddit once you have given marketing consent. Your cookie-consent choice itself is stored in your browser's local storage (as cookie_consent), not as a cookie.

You may manage your cookie preferences at any time via the Cookies link available in the footer of our website.

11Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the Service.

Where changes materially affect your rights, we will provide appropriate notice.

The date of the latest revision appears at the top of this Policy.

12Contact

For any questions regarding this Privacy Policy or the processing of your personal data, you may contact:

SAROMAN SERVICES SARL
9 rue des Colonnes
75002 Paris
France

Contact via the contact form on our website or the in-app chat while logged in to your account.